6

For some remote work, I sometimes use X11 forwarding on ssh connections, but usually don't. But, instead remebering to use the -X flag on my ssh connection, I can also set ForwardX11 yes to enable it by default.

My question is, is there any (significant) downside to having X11 forwarding always enabled while not actively using it?

I am using OpenSSH for this, server runs version 5.9, client 6.6.

Edit: I mean enabling it on a per host basis, in $HOME/.ssh/config, not globally.

Improve this question
2
  • The potential for X11 related security flaws on the remote system being used to exploit the X11 server on the SSH client system would be one downside. I tend to turn X11 (and agent!) forwarding off by default, and only enable it where (or when) I need it.
    – thrig
    Oct 15, 2015 at 19:34
  • @thrig Assuming a single trusted remote machine, would this still be the case?
    – Bert Peters
    Oct 15, 2015 at 19:42

1 Answer 1

Reset to default
8

When writing about this topic, I recommend reading through this paper:

http://www.giac.org/paper/gcih/571/x11-forwarding-ssh-considered-harmful/104780

It describes the consequences of letting ForwardX11 option turned on by default in really nice and prosaic way.

But to sum this up, yes, you should turn this off by default and let it on only for trusted servers where you actually need it in your local ~/.ssh/config file.

Untrusted machine is basically each machine, where somebody else has a root access, because that root can access your whole local X11 session, which is basically a thing you don't want from server in remote data-center or for internet facing machine that could be compromised.

Improve this answer
2
  • 1
    I very much enjoyed reading that paper. However, it also states that modern versions (3.9 and on) are immune to this attack because they use untrusted cookies. So, while this used to be an issue, it no longer is. Upvoting for the paper, at least.
    – Bert Peters
    Oct 15, 2015 at 20:18
  • 1
    Actually, the Untrusted part is currently also not everything-solving, because many applications just do not work with untrusted mode. And the security extension of X11 is by default disabled since around 2007, so modern systems are back where they were before when it comes to X11 forwarding over ssh.
    – Jakuje
    Oct 15, 2015 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.